Assessing the Political Motivations Behind Ransomware Attacks

Abstract

Although traditionally viewed as apolitical, recent developments suggest there may be connections between some ransomware groups and the Russian government. To better understand this relationship, we created a dataset of 4,194 ransomware victims posted to the dark web between May 2019 and May 2022. We find that Russia-based ransomware groups increased attacks before elections in several major democracies, and companies that curtailed operations in Russia after the invasion of Ukraine were more likely to be targeted; these findings suggest potential political motivations behind these attacks. We also analyze a major ransomware group's leaked internal communications, which show ties to the Kremlin. We argue that the Russian government maintains an informal cooperative relationship with groups by providing safe harbor from prosecution and receiving plausible deniability for attacks and access to skilled cyber actors. Our findings suggest ransomware presents an international security threat in addition to functioning as a form of crime.

Keywords: international security, cybercrime, ransomware, cybersecurity, international political economy

JEL Classification: F50, F51, F52